highlight-words libray is giving Math.random vunerbility scan as high about highlight-words HOT 6 CLOSED

#35 , can you apply this pull request it if you are ok with it or fix like you wanted

from highlight-words.

Sir can you please look the pr I created

from highlight-words.

Hi @shajithomas32! Thanks for taking a look at this. I don't really see the security issue though. The Math.random call is just to generate an ID with no overhead. It's not mean to be secure or unpredictable - just unique enough in most situations.

I'd say...if this is the only security problem with your app, then you're doing better than 99% of the apps out there. Congrats!

For us, the overhead of using crypto isn't worth it.

Seeing how you've PRed already, it means you can already use your code in your app if you so choose. To do this, you can make use of npm overrides, as documented here.

Essentially, do this:

{
  "overrides": {
    "highlight-words": "git://github.com/shajithomas32/highlight-words.git"
  }
}

So no matter what your dependencies use, you'll pull in your code.

from highlight-words.

from highlight-words.

Yes, that's what overrides does.

from highlight-words.

Thanks for your work around solution suggestion. But you can consider this request in future because it help us with the scan paper work. We got this scan result from fortify scan. Recommend highly to do scans because companies are strict with scan results even though scan results don't make sense in this case

from highlight-words.